Skip to content

Commit cb62754

Browse files
author
Ajay Kannan
committed
---
yaml --- r: 1799 b: refs/heads/master c: 3e9e1a0 h: refs/heads/master i: 1797: b0d028e 1795: 22c268d 1791: 25b23bb
1 parent 9e27435 commit cb62754

6 files changed

Lines changed: 226 additions & 2 deletions

File tree

‎[refs]‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
refs/heads/master: fa64fa581048bec07b9ad924752ffff19233e76d
2+
refs/heads/master: 3e9e1a0e8e034248c090e9c9b9918d3a783412be
33
refs/heads/travis: e21ee7b88a5edc3f3d8c71f90c3fc32abf7e8dd6
44
refs/heads/gh-pages: d1b373c30c176edc08692348167bec3a244bb823
55
refs/heads/bigquery: 762fa5830e6c398c0396177e3e7fd243bd62cfc3

‎trunk/gcloud-java-examples/src/main/java/com/google/gcloud/examples/resourcemanager/snippets/ModifyPolicy.java‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/*
2+
* Copyright 2016 Google Inc. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
/*
18+
* EDITING INSTRUCTIONS
19+
* This file is referenced in READMEs and javadoc. Any change to this file should be reflected in
20+
* the project's READMEs and package-info.java.
21+
*/
22+
23+
package com.google.gcloud.examples.resourcemanager.snippets;
24+
25+
import com.google.gcloud.Identity;
26+
import com.google.gcloud.resourcemanager.Policy;
27+
import com.google.gcloud.resourcemanager.Policy.Role;
28+
import com.google.gcloud.resourcemanager.Project;
29+
import com.google.gcloud.resourcemanager.ResourceManager;
30+
import com.google.gcloud.resourcemanager.ResourceManagerOptions;
31+
32+
/**
33+
* A snippet for Google Cloud Resource Manager showing how to modify a project's IAM policy.
34+
*/
35+
public class ModifyPolicy {
36+
37+
public static void main(String... args) {
38+
// Create Resource Manager service object
39+
// By default, credentials are inferred from the runtime environment.
40+
ResourceManager resourceManager = ResourceManagerOptions.defaultInstance().service();
41+
42+
// Get a project from the server
43+
String projectId = "some-project-id"; // Use an existing project's ID
44+
Project project = resourceManager.get(projectId);
45+
46+
// Get the project's policy
47+
Policy policy = project.getPolicy();
48+
49+
// Add a viewer
50+
Policy.Builder modifiedPolicy = policy.toBuilder();
51+
Identity newViewer = Identity.user("<insert user's email address here>");
52+
if (policy.bindings().containsKey(Role.viewer())) {
53+
modifiedPolicy.addIdentity(Role.viewer(), newViewer);
54+
} else {
55+
modifiedPolicy.addBinding(Role.viewer(), newViewer);
56+
}
57+
58+
// Write policy
59+
Policy updatedPolicy = project.replacePolicy(modifiedPolicy.build());
60+
61+
// Print policy
62+
System.out.printf("Updated policy for %s: %n%s%n", projectId, updatedPolicy);
63+
}
64+
}

‎trunk/gcloud-java-resourcemanager/README.md‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,9 +163,46 @@ while (projectIterator.hasNext()) {
163163
}
164164
```
165165

166+
#### Managing IAM Policies
167+
You can edit [Google Cloud IAM](https://cloud.google.com/iam/) (Identity and Access Management)
168+
policies on the project-level using this library as well. We recommend using the read-modify-write
169+
pattern to make policy changes. This entails reading the project's current policy, updating it
170+
locally, and then sending the modified policy for writing, as shown in the snippet below. First,
171+
add these imports:
172+
173+
```java
174+
import com.google.gcloud.Identity;
175+
import com.google.gcloud.resourcemanager.Policy;
176+
import com.google.gcloud.resourcemanager.Policy.Role;
177+
```
178+
179+
Assuming you have completed the steps above to create the `ResourceManager` service object and load
180+
a project from the server, you just need to add the following code:
181+
182+
```java
183+
// Get the project's policy
184+
Policy policy = project.getPolicy();
185+
186+
// Add a viewer
187+
Policy.Builder modifiedPolicy = policy.toBuilder();
188+
Identity newViewer = Identity.user("<insert user's email address here>");
189+
if (policy.bindings().containsKey(Role.viewer())) {
190+
modifiedPolicy.addIdentity(Role.viewer(), newViewer);
191+
} else {
192+
modifiedPolicy.addBinding(Role.viewer(), newViewer);
193+
}
194+
195+
// Write policy
196+
Policy updatedPolicy = project.replacePolicy(modifiedPolicy.build());
197+
```
198+
199+
Note that the policy you pass in to `replacePolicy` overwrites the original policy. For example, if
200+
the original policy has two bindings and you call `replacePolicy` with a new policy containing only
201+
one binding, the two original bindings are lost.
202+
166203
#### Complete source code
167204

168-
We put together all the code shown above into two programs. Both programs assume that you are
205+
We put together all the code shown above into three programs. The programs assume that you are
169206
running from your own desktop and used the Google Cloud SDK to authenticate yourself.
170207

171208
The first program creates a project if it does not exist. Complete source code can be found at
@@ -175,6 +212,10 @@ The second program updates a project if it exists and lists all projects the use
175212
view. Complete source code can be found at
176213
[UpdateAndListProjects.java](../gcloud-java-examples/src/main/java/com/google/gcloud/examples/resourcemanager/snippets/UpdateAndListProjects.java).
177214

215+
The third program modifies the IAM policy associated with a project using the read-modify-write
216+
pattern. Complete source code can be found at
217+
[ModifyPolicy.java](../gcloud-java-examples/src/main/java/com/google/gcloud/examples/resourcemanager/snippets/ModifyPolicy.java)
218+
178219
Java Versions
179220
-------------
180221

‎trunk/gcloud-java-resourcemanager/src/main/java/com/google/gcloud/resourcemanager/Policy.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,11 @@ public Builder toBuilder() {
178178
return new Builder(bindings(), etag(), version());
179179
}
180180

181+
@Override
182+
public String toString() {
183+
return toPb().toString();
184+
}
185+
181186
com.google.api.services.cloudresourcemanager.model.Policy toPb() {
182187
com.google.api.services.cloudresourcemanager.model.Policy policyPb =
183188
new com.google.api.services.cloudresourcemanager.model.Policy();

‎trunk/gcloud-java-resourcemanager/src/main/java/com/google/gcloud/resourcemanager/Project.java‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,11 @@
1818

1919
import static com.google.common.base.Preconditions.checkNotNull;
2020

21+
import com.google.gcloud.resourcemanager.ResourceManager.Permission;
22+
2123
import java.io.IOException;
2224
import java.io.ObjectInputStream;
25+
import java.util.List;
2326
import java.util.Map;
2427
import java.util.Objects;
2528

@@ -198,6 +201,71 @@ public Project replace() {
198201
return resourceManager.replace(this);
199202
}
200203

204+
/**
205+
* Returns the IAM access control policy for the specified project. Returns {@code null} if the
206+
* resource does not exist or if you do not have adequate permission to view the project or get
207+
* the policy.
208+
*
209+
* @throws ResourceManagerException upon failure
210+
* @see <a href=
211+
* "https://cloud.google.com/resource-manager/reference/rest/v1beta1/projects/getIamPolicy">
212+
* Resource Manager getIamPolicy</a>
213+
*/
214+
public Policy getPolicy() {
215+
return resourceManager.getPolicy(projectId());
216+
}
217+
218+
/**
219+
* Sets the IAM access control policy for the specified project. Replaces any existing policy.
220+
* It is recommended that you use the read-modify-write pattern. See code samples and important
221+
* details of replacing policies in the documentation for {@link ResourceManager#replacePolicy}.
222+
*
223+
* @throws ResourceManagerException upon failure
224+
* @see ResourceManager#replacePolicy
225+
* @see <a href=
226+
* "https://cloud.google.com/resource-manager/reference/rest/v1beta1/projects/setIamPolicy">
227+
* Resource Manager setIamPolicy</a>
228+
*/
229+
public Policy replacePolicy(Policy newPolicy) {
230+
return resourceManager.replacePolicy(projectId(), newPolicy);
231+
}
232+
233+
/**
234+
* Returns the permissions that a caller has on this project. You typically don't call this method
235+
* if you're using Google Cloud Platform directly to manage permissions. This method is intended
236+
* for integration with your proprietary software, such as a customized graphical user interface.
237+
* For example, the Cloud Platform Console tests IAM permissions internally to determine which UI
238+
* should be available to the logged-in user.
239+
*
240+
* @return A list of booleans representing whether the caller has the permissions specified (in
241+
* the order of the given permissions)
242+
* @throws ResourceManagerException upon failure
243+
* @see <a href=
244+
* "https://cloud.google.com/resource-manager/reference/rest/v1beta1/projects/testIamPermissions">
245+
* Resource Manager testIamPermissions</a>
246+
*/
247+
List<Boolean> testPermissions(List<Permission> permissions) {
248+
return resourceManager.testPermissions(projectId(), permissions);
249+
}
250+
251+
/**
252+
* Returns the permissions that a caller has on this project. You typically don't call this method
253+
* if you're using Google Cloud Platform directly to manage permissions. This method is intended
254+
* for integration with your proprietary software, such as a customized graphical user interface.
255+
* For example, the Cloud Platform Console tests IAM permissions internally to determine which UI
256+
* should be available to the logged-in user.
257+
*
258+
* @return A list of booleans representing whether the caller has the permissions specified (in
259+
* the order of the given permissions)
260+
* @throws ResourceManagerException upon failure
261+
* @see <a href=
262+
* "https://cloud.google.com/resource-manager/reference/rest/v1beta1/projects/testIamPermissions">
263+
* Resource Manager testIamPermissions</a>
264+
*/
265+
List<Boolean> testPermissions(Permission first, Permission... others) {
266+
return resourceManager.testPermissions(projectId(), first, others);
267+
}
268+
201269
@Override
202270
public Builder toBuilder() {
203271
return new Builder(this);

‎trunk/gcloud-java-resourcemanager/src/test/java/com/google/gcloud/resourcemanager/ProjectTest.java‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,19 @@
2525
import static org.junit.Assert.assertEquals;
2626
import static org.junit.Assert.assertNull;
2727

28+
import com.google.common.collect.ImmutableList;
2829
import com.google.common.collect.ImmutableMap;
30+
import com.google.common.collect.ImmutableSet;
31+
import com.google.gcloud.Identity;
32+
import com.google.gcloud.resourcemanager.Policy.Role;
2933
import com.google.gcloud.resourcemanager.ProjectInfo.ResourceId;
34+
import com.google.gcloud.resourcemanager.ResourceManager.Permission;
3035

3136
import org.junit.After;
3237
import org.junit.Before;
3338
import org.junit.Test;
3439

40+
import java.util.List;
3541
import java.util.Map;
3642

3743
public class ProjectTest {
@@ -48,6 +54,13 @@ public class ProjectTest {
4854
.createTimeMillis(CREATE_TIME_MILLIS)
4955
.state(STATE)
5056
.build();
57+
private static final Identity USER = Identity.user("[email protected]");
58+
private static final Identity SERVICE_ACCOUNT =
59+
Identity.serviceAccount("[email protected]");
60+
private static final Policy POLICY = Policy.builder()
61+
.addBinding(Role.owner(), ImmutableSet.of(USER))
62+
.addBinding(Role.editor(), ImmutableSet.of(SERVICE_ACCOUNT))
63+
.build();
5164

5265
private ResourceManager serviceMockReturnsOptions = createStrictMock(ResourceManager.class);
5366
private ResourceManagerOptions mockOptions = createMock(ResourceManagerOptions.class);
@@ -205,6 +218,39 @@ public void testReplace() {
205218
compareProjectInfos(expectedReplacedProject, actualReplacedProject);
206219
}
207220

221+
@Test
222+
public void testGetPolicy() {
223+
expect(resourceManager.options()).andReturn(mockOptions).times(1);
224+
expect(resourceManager.getPolicy(PROJECT_ID)).andReturn(POLICY);
225+
replay(resourceManager);
226+
initializeProject();
227+
assertEquals(POLICY, project.getPolicy());
228+
}
229+
230+
@Test
231+
public void testReplacePolicy() {
232+
expect(resourceManager.options()).andReturn(mockOptions).times(1);
233+
expect(resourceManager.replacePolicy(PROJECT_ID, POLICY)).andReturn(POLICY);
234+
replay(resourceManager);
235+
initializeProject();
236+
assertEquals(POLICY, project.replacePolicy(POLICY));
237+
}
238+
239+
@Test
240+
public void testTestPermissions() {
241+
List<Boolean> response = ImmutableList.of(true, true);
242+
expect(resourceManager.options()).andReturn(mockOptions).times(1);
243+
expect(resourceManager.testPermissions(PROJECT_ID, Permission.GET, Permission.DELETE))
244+
.andReturn(response);
245+
expect(resourceManager.testPermissions(
246+
PROJECT_ID, ImmutableList.of(Permission.GET, Permission.DELETE))).andReturn(response);
247+
replay(resourceManager);
248+
initializeProject();
249+
assertEquals(response, project.testPermissions(Permission.GET, Permission.DELETE));
250+
assertEquals(
251+
response, project.testPermissions(ImmutableList.of(Permission.GET, Permission.DELETE)));
252+
}
253+
208254
private void compareProjects(Project expected, Project value) {
209255
assertEquals(expected, value);
210256
compareProjectInfos(expected, value);

0 commit comments

Comments
 (0)